Privacy Policy
Last updated: 9 November 2026
- We keep only what the game needs: your e-mail address, your date of birth (to check you are 18+) and your game progress.
- We do not sell your data. A cookie for measuring our own ads (the Meta Pixel) is only used on the website if you accept it.
- Your data is stored in the EU (Frankfurt, Germany).
- You can delete your account yourself at any time, and ask us to see your data.
1. Who is responsible
Millstone
Acacialaan 18, 2282 AX Rijswijk, the Netherlands
Chamber of Commerce (KvK) number: 89795857
E-mail: info@lootvale.com
2. What we keep and why
| Data | Why | Legal basis |
|---|---|---|
| E-mail address and password (stored only as a secure hash) | Your account: signing in, confirming your address, resetting your password. | Contract |
| If you sign in with Facebook: the e-mail address, name and profile picture link that Facebook sends us, and the ID Facebook gives you for Lootvale | Your account: signing in with Facebook. We ask Facebook for nothing else (only the permissions public_profile and email), and we never post anything; your date of birth we ask you ourselves. | Contract |
| If you sign in with Google: the e-mail address, name and profile picture link that Google sends us, and your Google account ID | Your account: signing in with Google. We ask Google for nothing else; your date of birth we ask you ourselves. | Contract |
| Date of birth | To make sure only adults (18+) play. It is not shown to other players. | Legal obligation and contract |
| Game progress: coins, spins, buildings, shields, and a log of your spins with time and result | To run the game, decide spins on the server and look into problems or cheating. | Contract |
| Messages you write in your team's chat | Team chat, and looking into messages that players report. | Contract |
| In the Android app, if you turn notifications on: a push token for your phone, your player ID and your language | Sending you the notifications you asked for. You can turn them off in the game or in your phone's settings. | Consent |
| Technical data: IP address, browser and time of requests, in server logs | Security and keeping the game running. | Legitimate interest |
3. Storage on your device
The game stores a few things in your browser's local storage: your sign-in session, your language and your sound settings, whether this browser has signed in before (so the form opens on "Sign in"), and your cookie choice. These are needed for the game to work and are not used to follow you. Your cookie choice is kept for 12 months; you can change it at any time under Settings → Privacy and terms → Cookie settings.
Only if you click Accept, on the website only (never in the Android app), we also load the Meta Pixel (Meta Platforms Ireland Ltd.). It tells Meta that a visitor opened the page, signed up or reached floor 3, so we can see which of our ads on Facebook and Instagram bring players and show our ads to people who visited the website. It sets the cookies _fbp and _fbc (kept up to 90 days). What Meta does with this is covered by Meta's privacy policy; Meta and we are jointly responsible for collecting it. We never send your name, e-mail address or account id to Meta through the pixel. Legal basis: your consent (art. 6(1)(a) GDPR). If you withdraw your consent, the pixel stops and its cookies are removed.
4. Who else processes your data
- Supabase (database and accounts), servers in Frankfurt, Germany.
- Vercel (hosting of the website), which keeps short-lived request logs.
- Stripe (payments in the shop): when you buy something, Stripe handles the payment on its own page and receives your e-mail address and payment details. We keep only what you bought, the amount, the date and Stripe's reference, for 7 years for the tax books.
- Google Play (payments in the Android app): when you buy something in the app, Google handles the payment and receives your payment details under its own terms. We receive what you bought, the order number and whether it was paid.
- OneSignal (notifications in the Android app) and Google Firebase Cloud Messaging, which delivers them, only if you turn notifications on.
- Meta Pixel (Meta Platforms Ireland Ltd.), EU and US: measuring our ads on Facebook and Instagram and showing them to visitors of the website, only if you accept cookies (see Storage on your device).
Supabase, Vercel, Stripe and OneSignal process data only on our instructions, under a data processing agreement. Where data could reach the United States, this is covered by the EU-US Data Privacy Framework or the EU's standard contractual clauses.
5. How long we keep it
- Your account and game progress: until you delete your account in the game, or after 2 years without signing in.
- Server logs: at most 30 days.
- If you are refused at sign-up because you are under 18, no account is made and we keep nothing. If you signed in with Google or Facebook and give a date of birth under 18, the account is deleted at once.
6. Your rights
You can delete your account yourself in the game: how to delete your account. You can ask to see, correct, export or delete your data, or object to how we use it. E-mail info@lootvale.com from the address of your account; we answer within one month. If you are not happy with how we handle your data, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
7. Changes
When this policy changes, we update the date at the top and, for important changes, tell you in the game.